CVE-2026-44727

HTTP handlers of the nbconvert module in jupyter_server render HTML content authored by users in the context of the Jupyter domain without a sandbox directive in the Content-Security-Policy header. The default behavior of nbconvert.HTMLExporter does not sanitize notebook content, allowing malicious JavaScript code to be embedded in the display_data field of cell output. When a victim opens such a notebook through the web interface, the XSS payload executes in the privileged context of the Jupyter origin, giving the attacker access to the session, API, and the ability to remotely execute code through the kernel.

An attacker can hijack a user session through cookie theft, execute arbitrary requests to /api/* with the victim's full permissions, and remotely execute code (kernel RCE) on the Jupyter server.

Jupyter Server should be updated to version 2.20 or newer, where the vulnerability has been fixed. The patch is available in the project repository (commit 6cbee8d65e71abac851c4492fea987ad080580bd).

Jupyter Server in versions before 2.20